/*
* Telnet backend.
*/

#include <stdio.h>
#include <stdlib.h>
#include <limits.h>

#include "putty.h"

#ifndef FALSE
#define FALSE 0
#endif
#ifndef TRUE
#define TRUE 1
#endif

#define	IAC	255		       /* interpret as command: */
#define	DONT	254		       /* you are not to use option */
#define	DO	253		       /* please, you use option */
#define	WONT	252		       /* I won't use option */
#define	WILL	251		       /* I will use option */
#define	SB	250		       /* interpret as subnegotiation */
#define	SE	240		       /* end sub negotiation */

#define GA      249		       /* you may reverse the line */
#define EL      248		       /* erase the current line */
#define EC      247		       /* erase the current character */
#define	AYT	246		       /* are you there */
#define	AO	245		       /* abort output--but let prog finish */
#define	IP	244		       /* interrupt process--permanently */
#define	BREAK	243		       /* break */
#define DM      242		       /* data mark--for connect. cleaning */
#define NOP     241		       /* nop */
#define EOR     239		       /* end of record (transparent mode) */
#define ABORT   238		       /* Abort process */
#define SUSP    237		       /* Suspend process */
#define xEOF    236		       /* End of file: EOF is already used... */

#define TELOPTS(X) \
	X(BINARY, 0)                       /* 8-bit data path */ \
	X(ECHO, 1)                         /* echo */ \
	X(RCP, 2)                          /* prepare to reconnect */ \
	X(SGA, 3)                          /* suppress go ahead */ \
	X(NAMS, 4)                         /* approximate message size */ \
	X(STATUS, 5)                       /* give status */ \
	X(TM, 6)                           /* timing mark */ \
	X(RCTE, 7)                         /* remote controlled transmission and echo */ \
	X(NAOL, 8)                         /* negotiate about output line width */ \
	X(NAOP, 9)                         /* negotiate about output page size */ \
	X(NAOCRD, 10)                      /* negotiate about CR disposition */ \
	X(NAOHTS, 11)                      /* negotiate about horizontal tabstops */ \
	X(NAOHTD, 12)                      /* negotiate about horizontal tab disposition */ \
	X(NAOFFD, 13)                      /* negotiate about formfeed disposition */ \
	X(NAOVTS, 14)                      /* negotiate about vertical tab stops */ \
	X(NAOVTD, 15)                      /* negotiate about vertical tab disposition */ \
	X(NAOLFD, 16)                      /* negotiate about output LF disposition */ \
	X(XASCII, 17)                      /* extended ascic character set */ \
	X(LOGOUT, 18)                      /* force logout */ \
	X(BM, 19)                          /* byte macro */ \
	X(DET, 20)                         /* data entry terminal */ \
	X(SUPDUP, 21)                      /* supdup protocol */ \
	X(SUPDUPOUTPUT, 22)                /* supdup output */ \
	X(SNDLOC, 23)                      /* send location */ \
	X(TTYPE, 24)                       /* terminal type */ \
	X(EOR, 25)                         /* end or record */ \
	X(TUID, 26)                        /* TACACS user identification */ \
	X(OUTMRK, 27)                      /* output marking */ \
	X(TTYLOC, 28)                      /* terminal location number */ \
	X(3270REGIME, 29)                  /* 3270 regime */ \
	X(X3PAD, 30)                       /* X.3 PAD */ \
	X(NAWS, 31)                        /* window size */ \
	X(TSPEED, 32)                      /* terminal speed */ \
	X(LFLOW, 33)                       /* remote flow control */ \
	X(LINEMODE, 34)                    /* Linemode option */ \
	X(XDISPLOC, 35)                    /* X Display Location */ \
	X(OLD_ENVIRON, 36)                 /* Old - Environment variables */ \
	X(AUTHENTICATION, 37)              /* Authenticate */ \
	X(ENCRYPT, 38)                     /* Encryption option */ \
	X(NEW_ENVIRON, 39)                 /* New - Environment variables */ \
	X(TN3270E, 40)                     /* TN3270 enhancements */ \
	X(XAUTH, 41)                       \
	X(CHARSET, 42)                     /* Character set */ \
	X(RSP, 43)                         /* Remote serial port */ \
	X(COM_PORT_OPTION, 44)             /* Com port control */ \
	X(SLE, 45)                         /* Suppress local echo */ \
	X(STARTTLS, 46)                    /* Start TLS */ \
	X(KERMIT, 47)                      /* Automatic Kermit file transfer */ \
	X(SEND_URL, 48)                    \
	X(FORWARD_X, 49)                   \
	X(PRAGMA_LOGON, 138)               \
	X(SSPI_LOGON, 139)                 \
	X(PRAGMA_HEARTBEAT, 140)           \
	X(EXOPL, 255)                      /* extended-options-list */

#define telnet_enum(x,y) TELOPT_##x = y,
enum { TELOPTS(telnet_enum) dummy=0 };
#undef telnet_enum

#define	TELQUAL_IS	0	       /* option is... */
#define	TELQUAL_SEND	1	       /* send option */
#define	TELQUAL_INFO	2	       /* ENVIRON: informational version of IS */
#define BSD_VAR 1
#define BSD_VALUE 0
#define RFC_VAR 0
#define RFC_VALUE 1

#define CR 13
#define LF 10
#define NUL 0

#define iswritable(x) \
	( (x) != IAC && \
	(telnet->opt_states[o_we_bin.index] == ACTIVE || (x) != CR))

static const char *telopt(int opt)
{
#define telnet_str(x,y) case TELOPT_##x: return #x;
	switch (opt) {
		TELOPTS(telnet_str)
	default:
		return "<unknown>";
	}
#undef telnet_str
}

static void telnet_size(void *handle, int width, int height);

struct Opt {
	int send;			       /* what we initially send */
	int nsend;			       /* -ve send if requested to stop it */
	int ack, nak;		       /* +ve and -ve acknowledgements */
	int option;			       /* the option code */
	int index;			       /* index into telnet->opt_states[] */
	enum {
		REQUESTED, ACTIVE, INACTIVE, REALLY_INACTIVE
	} initial_state;
};

enum {
	OPTINDEX_NAWS,
	OPTINDEX_TSPEED,
	OPTINDEX_TTYPE,
	OPTINDEX_OENV,
	OPTINDEX_NENV,
	OPTINDEX_ECHO,
	OPTINDEX_WE_SGA,
	OPTINDEX_THEY_SGA,
	OPTINDEX_WE_BIN,
	OPTINDEX_THEY_BIN,
	NUM_OPTS
};

static const struct Opt o_naws =
{ WILL, WONT, DO, DONT, TELOPT_NAWS, OPTINDEX_NAWS, REQUESTED };
static const struct Opt o_tspeed =
{ WILL, WONT, DO, DONT, TELOPT_TSPEED, OPTINDEX_TSPEED, REQUESTED };
static const struct Opt o_ttype =
{ WILL, WONT, DO, DONT, TELOPT_TTYPE, OPTINDEX_TTYPE, REQUESTED };
static const struct Opt o_oenv =
{ WILL, WONT, DO, DONT, TELOPT_OLD_ENVIRON, OPTINDEX_OENV, INACTIVE };
static const struct Opt o_nenv =
{ WILL, WONT, DO, DONT, TELOPT_NEW_ENVIRON, OPTINDEX_NENV, REQUESTED };
static const struct Opt o_echo =
{ DO, DONT, WILL, WONT, TELOPT_ECHO, OPTINDEX_ECHO, REQUESTED };
static const struct Opt o_we_sga =
{ WILL, WONT, DO, DONT, TELOPT_SGA, OPTINDEX_WE_SGA, REQUESTED };
static const struct Opt o_they_sga =
{ DO, DONT, WILL, WONT, TELOPT_SGA, OPTINDEX_THEY_SGA, REQUESTED };
static const struct Opt o_we_bin =
{ WILL, WONT, DO, DONT, TELOPT_BINARY, OPTINDEX_WE_BIN, INACTIVE };
static const struct Opt o_they_bin =
{ DO, DONT, WILL, WONT, TELOPT_BINARY, OPTINDEX_THEY_BIN, INACTIVE };

static const struct Opt *const opts[] = {
	&o_naws, &o_tspeed, &o_ttype, &o_oenv, &o_nenv, &o_echo,
	&o_we_sga, &o_they_sga, &o_we_bin, &o_they_bin, NULL
};

typedef struct telnet_tag {
	const struct plug_function_table *fn;
	/* the above field _must_ be first in the structure */

	Socket s;
	int closed_on_socket_error;

	void *frontend;
	void *ldisc;
	int term_width, term_height;

	int opt_states[NUM_OPTS];

	int echoing, editing;
	int activated;
	int bufsize;
	int in_synch;
	int sb_opt, sb_len;
	unsigned char *sb_buf;
	int sb_size;
	int session_started;

	enum {
		TOP_LEVEL, SEENIAC, SEENWILL, SEENWONT, SEENDO, SEENDONT,
		SEENSB, SUBNEGOT, SUBNEG_IAC, SEENCR
	} state;

	Conf *conf;

	Pinger pinger;
} *Telnet;

#define TELNET_MAX_BACKLOG 4096

#define SB_DELTA 1024

static void c_write(Telnet telnet, const char *buf, int len)
{
	int backlog;
	backlog = from_backend(telnet->frontend, 0, buf, len);
	sk_set_frozen(telnet->s, backlog > TELNET_MAX_BACKLOG);
}

static void log_option(Telnet telnet, const char *sender, int cmd, int option)
{
	char *buf;
	/*
	* The strange-looking "<?""?>" below is there to avoid a
	* trigraph - a double question mark followed by > maps to a
	* closing brace character!
	*/
	buf = dupprintf("%s:\t%s %s", sender,
		(cmd == WILL ? "WILL" : cmd == WONT ? "WONT" :
		cmd == DO ? "DO" : cmd == DONT ? "DONT" : "<?""?>"),
		telopt(option));
	logevent(telnet->frontend, buf);
	sfree(buf);
}

static void send_opt(Telnet telnet, int cmd, int option)
{
	unsigned char b[3];

	b[0] = IAC;
	b[1] = cmd;
	b[2] = option;
	telnet->bufsize = sk_write(telnet->s, (char *)b, 3);
	log_option(telnet, "client", cmd, option);
}

static void deactivate_option(Telnet telnet, const struct Opt *o)
{
	if (telnet->opt_states[o->index] == REQUESTED ||
		telnet->opt_states[o->index] == ACTIVE)
		send_opt(telnet, o->nsend, o->option);
	telnet->opt_states[o->index] = REALLY_INACTIVE;
}

/*
* Generate side effects of enabling or disabling an option.
*/
static void option_side_effects(Telnet telnet, const struct Opt *o, int enabled)
{
	if (o->option == TELOPT_ECHO && o->send == DO)
		telnet->echoing = !enabled;
	else if (o->option == TELOPT_SGA && o->send == DO)
		telnet->editing = !enabled;
	if (telnet->ldisc)		       /* cause ldisc to notice the change */
		ldisc_echoedit_update(telnet->ldisc);

	/* Ensure we get the minimum options */
	if (!telnet->activated) {
		if (telnet->opt_states[o_echo.index] == INACTIVE) {
			telnet->opt_states[o_echo.index] = REQUESTED;
			send_opt(telnet, o_echo.send, o_echo.option);
		}
		if (telnet->opt_states[o_we_sga.index] == INACTIVE) {
			telnet->opt_states[o_we_sga.index] = REQUESTED;
			send_opt(telnet, o_we_sga.send, o_we_sga.option);
		}
		if (telnet->opt_states[o_they_sga.index] == INACTIVE) {
			telnet->opt_states[o_they_sga.index] = REQUESTED;
			send_opt(telnet, o_they_sga.send, o_they_sga.option);
		}
		telnet->activated = TRUE;
	}
}

static void activate_option(Telnet telnet, const struct Opt *o)
{
	if (o->send == WILL && o->option == TELOPT_NAWS)
		telnet_size(telnet, telnet->term_width, telnet->term_height);
	if (o->send == WILL &&
		(o->option == TELOPT_NEW_ENVIRON ||
		o->option == TELOPT_OLD_ENVIRON)) {
			/*
			* We may only have one kind of ENVIRON going at a time.
			* This is a hack, but who cares.
			*/
			deactivate_option(telnet, o->option ==
				TELOPT_NEW_ENVIRON ? &o_oenv : &o_nenv);
	}
	option_side_effects(telnet, o, 1);
}

static void refused_option(Telnet telnet, const struct Opt *o)
{
	if (o->send == WILL && o->option == TELOPT_NEW_ENVIRON &&
		telnet->opt_states[o_oenv.index] == INACTIVE) {
			send_opt(telnet, WILL, TELOPT_OLD_ENVIRON);
			telnet->opt_states[o_oenv.index] = REQUESTED;
	}
	option_side_effects(telnet, o, 0);
}

static void proc_rec_opt(Telnet telnet, int cmd, int option)
{
	const struct Opt *const *o;

	log_option(telnet, "server", cmd, option);
	for (o = opts; *o; o++) {
		if ((*o)->option == option && (*o)->ack == cmd) {
			switch (telnet->opt_states[(*o)->index]) {
			case REQUESTED:
				telnet->opt_states[(*o)->index] = ACTIVE;
				activate_option(telnet, *o);
				break;
			case ACTIVE:
				break;
			case INACTIVE:
				telnet->opt_states[(*o)->index] = ACTIVE;
				send_opt(telnet, (*o)->send, option);
				activate_option(telnet, *o);
				break;
			case REALLY_INACTIVE:
				send_opt(telnet, (*o)->nsend, option);
				break;
			}
			return;
		} else if ((*o)->option == option && (*o)->nak == cmd) {
			switch (telnet->opt_states[(*o)->index]) {
			case REQUESTED:
				telnet->opt_states[(*o)->index] = INACTIVE;
				refused_option(telnet, *o);
				break;
			case ACTIVE:
				telnet->opt_states[(*o)->index] = INACTIVE;
				send_opt(telnet, (*o)->nsend, option);
				option_side_effects(telnet, *o, 0);
				break;
			case INACTIVE:
			case REALLY_INACTIVE:
				break;
			}
			return;
		}
	}
	/*
	* If we reach here, the option was one we weren't prepared to
	* cope with. If the request was positive (WILL or DO), we send
	* a negative ack to indicate refusal. If the request was
	* negative (WONT / DONT), we must do nothing.
	*/
	if (cmd == WILL || cmd == DO)
		send_opt(telnet, (cmd == WILL ? DONT : WONT), option);
}

static void process_subneg(Telnet telnet)
{
	unsigned char *b, *p, *q;
	int var, value, n, bsize;
	char *e, *eval, *ekey, *user;

	switch (telnet->sb_opt) {
	case TELOPT_TSPEED:
		if (telnet->sb_len == 1 && telnet->sb_buf[0] == TELQUAL_SEND) {
			char *logbuf;
			char *termspeed = conf_get_str(telnet->conf, CONF_termspeed);
			b = snewn(20 + strlen(termspeed), unsigned char);
			b[0] = IAC;
			b[1] = SB;
			b[2] = TELOPT_TSPEED;
			b[3] = TELQUAL_IS;
			strcpy((char *)(b + 4), termspeed);
			n = 4 + strlen(termspeed);
			b[n] = IAC;
			b[n + 1] = SE;
			telnet->bufsize = sk_write(telnet->s, (char *)b, n + 2);
			logevent(telnet->frontend, "server:\tSB TSPEED SEND");
			logbuf = dupprintf("client:\tSB TSPEED IS %s", termspeed);
			logevent(telnet->frontend, logbuf);
			sfree(logbuf);
			sfree(b);
		} else
			logevent(telnet->frontend, "server:\tSB TSPEED <something weird>");
		break;
	case TELOPT_TTYPE:
		if (telnet->sb_len == 1 && telnet->sb_buf[0] == TELQUAL_SEND) {
			char *logbuf;
			char *termtype = conf_get_str(telnet->conf, CONF_termtype);
			b = snewn(20 + strlen(termtype), unsigned char);
			b[0] = IAC;
			b[1] = SB;
			b[2] = TELOPT_TTYPE;
			b[3] = TELQUAL_IS;
			for (n = 0; termtype[n]; n++)
				b[n + 4] = (termtype[n] >= 'a' && termtype[n] <= 'z' ?
				termtype[n] + 'A' - 'a' :
			termtype[n]);
			b[n + 4] = IAC;
			b[n + 5] = SE;
			telnet->bufsize = sk_write(telnet->s, (char *)b, n + 6);
			b[n + 4] = 0;
			logevent(telnet->frontend, "server:\tSB TTYPE SEND");
			logbuf = dupprintf("client:\tSB TTYPE IS %s", b + 4);
			logevent(telnet->frontend, logbuf);
			sfree(logbuf);
			sfree(b);
		} else
			logevent(telnet->frontend, "server:\tSB TTYPE <something weird>\r\n");
		break;
	case TELOPT_OLD_ENVIRON:
	case TELOPT_NEW_ENVIRON:
		p = telnet->sb_buf;
		q = p + telnet->sb_len;
		if (p < q && *p == TELQUAL_SEND) {
			char *logbuf;
			p++;
			logbuf = dupprintf("server:\tSB %s SEND", telopt(telnet->sb_opt));
			logevent(telnet->frontend, logbuf);
			sfree(logbuf);
			if (telnet->sb_opt == TELOPT_OLD_ENVIRON) {
				if (conf_get_int(telnet->conf, CONF_rfc_environ)) {
					value = RFC_VALUE;
					var = RFC_VAR;
				} else {
					value = BSD_VALUE;
					var = BSD_VAR;
				}
				/*
				* Try to guess the sense of VAR and VALUE.
				*/
				while (p < q) {
					if (*p == RFC_VAR) {
						value = RFC_VALUE;
						var = RFC_VAR;
					} else if (*p == BSD_VAR) {
						value = BSD_VALUE;
						var = BSD_VAR;
					}
					p++;
				}
			} else {
				/*
				* With NEW_ENVIRON, the sense of VAR and VALUE
				* isn't in doubt.
				*/
				value = RFC_VALUE;
				var = RFC_VAR;
			}
			bsize = 20;
			for (eval = conf_get_str_strs(telnet->conf, CONF_environmt,
				NULL, &ekey);
				eval != NULL;
			eval = conf_get_str_strs(telnet->conf, CONF_environmt,
				ekey, &ekey))
				bsize += strlen(ekey) + strlen(eval) + 2;
			user = get_remote_username(telnet->conf);
			if (user)
				bsize += 6 + strlen(user);

			b = snewn(bsize, unsigned char);
			b[0] = IAC;
			b[1] = SB;
			b[2] = telnet->sb_opt;
			b[3] = TELQUAL_IS;
			n = 4;
			for (eval = conf_get_str_strs(telnet->conf, CONF_environmt,
				NULL, &ekey);
				eval != NULL;
			eval = conf_get_str_strs(telnet->conf, CONF_environmt,
				ekey, &ekey)) {
					b[n++] = var;
					for (e = ekey; *e; e++)
						b[n++] = *e;
					b[n++] = value;
					for (e = eval; *e; e++)
						b[n++] = *e;
			}
			if (user) {
				b[n++] = var;
				b[n++] = 'U';
				b[n++] = 'S';
				b[n++] = 'E';
				b[n++] = 'R';
				b[n++] = value;
				for (e = user; *e; e++)
					b[n++] = *e;
			}
			b[n++] = IAC;
			b[n++] = SE;
			telnet->bufsize = sk_write(telnet->s, (char *)b, n);
			if (n == 6) {
				logbuf = dupprintf("client:\tSB %s IS <nothing>",
					telopt(telnet->sb_opt));
				logevent(telnet->frontend, logbuf);
				sfree(logbuf);
			} else {
				logbuf = dupprintf("client:\tSB %s IS:",
					telopt(telnet->sb_opt));
				logevent(telnet->frontend, logbuf);
				sfree(logbuf);
				for (eval = conf_get_str_strs(telnet->conf, CONF_environmt,
					NULL, &ekey);
					eval != NULL;
				eval = conf_get_str_strs(telnet->conf, CONF_environmt,
					ekey, &ekey)) {
						logbuf = dupprintf("\t%s=%s", ekey, eval);
						logevent(telnet->frontend, logbuf);
						sfree(logbuf);
				}
				if (user) {
					logbuf = dupprintf("\tUSER=%s", user);
					logevent(telnet->frontend, logbuf);
					sfree(logbuf);
				}
			}
			sfree(b);
			sfree(user);
		}
		break;
	}
}

static void do_telnet_read(Telnet telnet, char *buf, int len)
{
	char *outbuf = NULL;
	int outbuflen = 0, outbufsize = 0;

#define ADDTOBUF(c) do { \
	if (outbuflen >= outbufsize) { \
	outbufsize = outbuflen + 256; \
	outbuf = sresize(outbuf, outbufsize, char); \
	} \
	outbuf[outbuflen++] = (c); \
	} while (0)

	while (len--) {
		int c = (unsigned char) *buf++;

		switch (telnet->state) {
		case TOP_LEVEL:
		case SEENCR:
			if (c == NUL && telnet->state == SEENCR)
				telnet->state = TOP_LEVEL;
			else if (c == IAC)
				telnet->state = SEENIAC;
			else {
				if (!telnet->in_synch)
					ADDTOBUF(c);

#if 1
				/* I can't get the F***ing winsock to insert the urgent IAC
				* into the right position! Even with SO_OOBINLINE it gives
				* it to recv too soon. And of course the DM byte (that
				* arrives in the same packet!) appears several K later!!
				*
				* Oh well, we do get the DM in the right place so I'll
				* just stop hiding on the next 0xf2 and hope for the best.
				*/
				else if (c == DM)
					telnet->in_synch = 0;
#endif
				if (c == CR && telnet->opt_states[o_they_bin.index] != ACTIVE)
					telnet->state = SEENCR;
				else
					telnet->state = TOP_LEVEL;
			}
			break;
		case SEENIAC:
			if (c == DO)
				telnet->state = SEENDO;
			else if (c == DONT)
				telnet->state = SEENDONT;
			else if (c == WILL)
				telnet->state = SEENWILL;
			else if (c == WONT)
				telnet->state = SEENWONT;
			else if (c == SB)
				telnet->state = SEENSB;
			else if (c == DM) {
				telnet->in_synch = 0;
				telnet->state = TOP_LEVEL;
			} else {
				/* ignore everything else; print it if it's IAC */
				if (c == IAC) {
					ADDTOBUF(c);
				}
				telnet->state = TOP_LEVEL;
			}
			break;
		case SEENWILL:
			proc_rec_opt(telnet, WILL, c);
			telnet->state = TOP_LEVEL;
			break;
		case SEENWONT:
			proc_rec_opt(telnet, WONT, c);
			telnet->state = TOP_LEVEL;
			break;
		case SEENDO:
			proc_rec_opt(telnet, DO, c);
			telnet->state = TOP_LEVEL;
			break;
		case SEENDONT:
			proc_rec_opt(telnet, DONT, c);
			telnet->state = TOP_LEVEL;
			break;
		case SEENSB:
			telnet->sb_opt = c;
			telnet->sb_len = 0;
			telnet->state = SUBNEGOT;
			break;
		case SUBNEGOT:
			if (c == IAC)
				telnet->state = SUBNEG_IAC;
			else {
subneg_addchar:
				if (telnet->sb_len >= telnet->sb_size) {
					telnet->sb_size += SB_DELTA;
					telnet->sb_buf = sresize(telnet->sb_buf, telnet->sb_size,
						unsigned char);
				}
				telnet->sb_buf[telnet->sb_len++] = c;
				telnet->state = SUBNEGOT;	/* in case we came here by goto */
			}
			break;
		case SUBNEG_IAC:
			if (c != SE)
				goto subneg_addchar;   /* yes, it's a hack, I know, but... */
			else {
				process_subneg(telnet);
				telnet->state = TOP_LEVEL;
			}
			break;
		}
	}

	if (outbuflen)
		c_write(telnet, outbuf, outbuflen);
	sfree(outbuf);
}

static void telnet_log(Plug plug, int type, SockAddr addr, int port,
	const char *error_msg, int error_code)
{
	Telnet telnet = (Telnet) plug;
	backend_socket_log(telnet->frontend, type, addr, port,
		error_msg, error_code, telnet->conf,
		telnet->session_started);
}

static void telnet_closing(Plug plug, const char *error_msg, int error_code,
	int calling_back)
{
	Telnet telnet = (Telnet) plug;

	/*
	* We don't implement independent EOF in each direction for Telnet
	* connections; as soon as we get word that the remote side has
	* sent us EOF, we wind up the whole connection.
	*/

	if (telnet->s) {
		sk_close(telnet->s);
		telnet->s = NULL;
		if (error_msg)
			telnet->closed_on_socket_error = TRUE;
		notify_remote_exit(telnet->frontend);
	}
	if (error_msg) {
		logevent(telnet->frontend, error_msg);
		connection_fatal(telnet->frontend, "%s", error_msg);
	}
	/* Otherwise, the remote side closed the connection normally. */
}

static void telnet_receive(Plug plug, int urgent, char *data, int len)
{
	Telnet telnet = (Telnet) plug;
	if (urgent)
		telnet->in_synch = TRUE;
	telnet->session_started = TRUE;
	do_telnet_read(telnet, data, len);
}

static void telnet_sent(Plug plug, int bufsize)
{
	Telnet telnet = (Telnet) plug;
	telnet->bufsize = bufsize;
}

/*
* Called to set up the Telnet connection.
*
* Returns an error message, or NULL on success.
*
* Also places the canonical host name into `realhost'. It must be
* freed by the caller.
*/
static const char *telnet_init(void *frontend_handle, void **backend_handle,
	Conf *conf, const char *host, int port,
	char **realhost, int nodelay, int keepalive)
{
	static const struct plug_function_table fn_table = {
		telnet_log,
		telnet_closing,
		telnet_receive,
		telnet_sent
	};
	SockAddr addr;
	const char *err;
	Telnet telnet;
	char *loghost;
	int addressfamily;

	telnet = snew(struct telnet_tag);
	telnet->fn = &fn_table;
	telnet->conf = conf_copy(conf);
	telnet->s = NULL;
	telnet->closed_on_socket_error = FALSE;
	telnet->echoing = TRUE;
	telnet->editing = TRUE;
	telnet->activated = FALSE;
	telnet->sb_buf = NULL;
	telnet->sb_size = 0;
	telnet->frontend = frontend_handle;
	telnet->term_width = conf_get_int(telnet->conf, CONF_width);
	telnet->term_height = conf_get_int(telnet->conf, CONF_height);
	telnet->state = TOP_LEVEL;
	telnet->ldisc = NULL;
	telnet->pinger = NULL;
	telnet->session_started = TRUE;
	*backend_handle = telnet;

	/*
	* Try to find host.
	*/
	addressfamily = conf_get_int(telnet->conf, CONF_addressfamily);
	addr = name_lookup(host, port, realhost, telnet->conf, addressfamily,
		telnet->frontend, "Telnet connection");
	if ((err = sk_addr_error(addr)) != NULL) {
		sk_addr_free(addr);
		return err;
	}

	if (port < 0)
		port = 23;		       /* default telnet port */

	/*
	* Open socket.
	*/
	telnet->s = new_connection(addr, *realhost, port, 0, 1,
		nodelay, keepalive, (Plug) telnet, telnet->conf);
	if ((err = sk_socket_error(telnet->s)) != NULL)
		return err;

	telnet->pinger = pinger_new(telnet->conf, &telnet_backend, telnet);

	/*
	* Initialise option states.
	*/
	if (conf_get_int(telnet->conf, CONF_passive_telnet)) {
		const struct Opt *const *o;

		for (o = opts; *o; o++)
			telnet->opt_states[(*o)->index] = INACTIVE;
	} else {
		const struct Opt *const *o;

		for (o = opts; *o; o++) {
			telnet->opt_states[(*o)->index] = (*o)->initial_state;
			if (telnet->opt_states[(*o)->index] == REQUESTED)
				send_opt(telnet, (*o)->send, (*o)->option);
		}
		telnet->activated = TRUE;
	}

	/*
	* Set up SYNCH state.
	*/
	telnet->in_synch = FALSE;

	/*
	* We can send special commands from the start.
	*/
	update_specials_menu(telnet->frontend);

	/*
	* loghost overrides realhost, if specified.
	*/
	loghost = conf_get_str(telnet->conf, CONF_loghost);
	if (*loghost) {
		char *colon;

		sfree(*realhost);
		*realhost = dupstr(loghost);

		colon = host_strrchr(*realhost, ':');
		if (colon)
			*colon++ = '\0';
	}

	return NULL;
}

static void telnet_free(void *handle)
{
	Telnet telnet = (Telnet) handle;

	sfree(telnet->sb_buf);
	if (telnet->s)
		sk_close(telnet->s);
	if (telnet->pinger)
		pinger_free(telnet->pinger);
	conf_free(telnet->conf);
	sfree(telnet);
}
/*
* Reconfigure the Telnet backend. There's no immediate action
* necessary, in this backend: we just save the fresh config for
* any subsequent negotiations.
*/
static void telnet_reconfig(void *handle, Conf *conf)
{
	Telnet telnet = (Telnet) handle;
	pinger_reconfig(telnet->pinger, telnet->conf, conf);
	conf_free(telnet->conf);
	telnet->conf = conf_copy(conf);
}

/*
* Called to send data down the Telnet connection.
*/
static int telnet_send(void *handle, const char *buf, int len)
{
	Telnet telnet = (Telnet) handle;
	unsigned char *p, *end;
	static const unsigned char iac[2] = { IAC, IAC };
	static const unsigned char cr[2] = { CR, NUL };
#if 0
	static const unsigned char nl[2] = { CR, LF };
#endif

	if (telnet->s == NULL)
		return 0;

	p = (unsigned char *)buf;
	end = (unsigned char *)(buf + len);
	while (p < end) {
		unsigned char *q = p;

		while (p < end && iswritable(*p))
			p++;
		telnet->bufsize = sk_write(telnet->s, (char *)q, p - q);

		while (p < end && !iswritable(*p)) {
			telnet->bufsize = 
				sk_write(telnet->s, (char *)(*p == IAC ? iac : cr), 2);
			p++;
		}
	}

	return telnet->bufsize;
}

/*
* Called to query the current socket sendability status.
*/
static int telnet_sendbuffer(void *handle)
{
	Telnet telnet = (Telnet) handle;
	return telnet->bufsize;
}

/*
* Called to set the size of the window from Telnet's POV.
*/
static void telnet_size(void *handle, int width, int height)
{
	Telnet telnet = (Telnet) handle;
	unsigned char b[24];
	int n;
	char *logbuf;

	telnet->term_width = width;
	telnet->term_height = height;

	if (telnet->s == NULL || telnet->opt_states[o_naws.index] != ACTIVE)
		return;
	n = 0;
	b[n++] = IAC;
	b[n++] = SB;
	b[n++] = TELOPT_NAWS;
	b[n++] = telnet->term_width >> 8;
	if (b[n-1] == IAC) b[n++] = IAC;   /* duplicate any IAC byte occurs */
	b[n++] = telnet->term_width & 0xFF;
	if (b[n-1] == IAC) b[n++] = IAC;   /* duplicate any IAC byte occurs */
	b[n++] = telnet->term_height >> 8;
	if (b[n-1] == IAC) b[n++] = IAC;   /* duplicate any IAC byte occurs */
	b[n++] = telnet->term_height & 0xFF;
	if (b[n-1] == IAC) b[n++] = IAC;   /* duplicate any IAC byte occurs */
	b[n++] = IAC;
	b[n++] = SE;
	telnet->bufsize = sk_write(telnet->s, (char *)b, n);
	logbuf = dupprintf("client:\tSB NAWS %d,%d",
		telnet->term_width, telnet->term_height);
	logevent(telnet->frontend, logbuf);
	sfree(logbuf);
}

/*
* Send Telnet special codes.
*/
static void telnet_special(void *handle, Telnet_Special code)
{
	Telnet telnet = (Telnet) handle;
	unsigned char b[2];

	if (telnet->s == NULL)
		return;

	b[0] = IAC;
	switch (code) {
	case TS_AYT:
		b[1] = AYT;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_BRK:
		b[1] = BREAK;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_EC:
		b[1] = EC;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_EL:
		b[1] = EL;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_GA:
		b[1] = GA;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_NOP:
		b[1] = NOP;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_ABORT:
		b[1] = ABORT;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_AO:
		b[1] = AO;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_IP:
		b[1] = IP;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_SUSP:
		b[1] = SUSP;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_EOR:
		b[1] = EOR;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_EOF:
		b[1] = xEOF;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		break;
	case TS_EOL:
		/* In BINARY mode, CR-LF becomes just CR -
		* and without the NUL suffix too. */
		if (telnet->opt_states[o_we_bin.index] == ACTIVE)
			telnet->bufsize = sk_write(telnet->s, "\r", 1);
		else
			telnet->bufsize = sk_write(telnet->s, "\r\n", 2);
		break;
	case TS_SYNCH:
		b[1] = DM;
		telnet->bufsize = sk_write(telnet->s, (char *)b, 1);
		telnet->bufsize = sk_write_oob(telnet->s, (char *)(b + 1), 1);
		break;
	case TS_RECHO:
		if (telnet->opt_states[o_echo.index] == INACTIVE ||
			telnet->opt_states[o_echo.index] == REALLY_INACTIVE) {
				telnet->opt_states[o_echo.index] = REQUESTED;
				send_opt(telnet, o_echo.send, o_echo.option);
		}
		break;
	case TS_LECHO:
		if (telnet->opt_states[o_echo.index] == ACTIVE) {
			telnet->opt_states[o_echo.index] = REQUESTED;
			send_opt(telnet, o_echo.nsend, o_echo.option);
		}
		break;
	case TS_PING:
		if (telnet->opt_states[o_they_sga.index] == ACTIVE) {
			b[1] = NOP;
			telnet->bufsize = sk_write(telnet->s, (char *)b, 2);
		}
		break;
	default:
		break;	/* never heard of it */
	}
}

static const struct telnet_special *telnet_get_specials(void *handle)
{
	static const struct telnet_special specials[] = {
		{"Are You There", TS_AYT},
		{"Break", TS_BRK},
		{"Synch", TS_SYNCH},
		{"Erase Character", TS_EC},
		{"Erase Line", TS_EL},
		{"Go Ahead", TS_GA},
		{"No Operation", TS_NOP},
		{NULL, TS_SEP},
		{"Abort Process", TS_ABORT},
		{"Abort Output", TS_AO},
		{"Interrupt Process", TS_IP},
		{"Suspend Process", TS_SUSP},
		{NULL, TS_SEP},
		{"End Of Record", TS_EOR},
		{"End Of File", TS_EOF},
		{NULL, TS_EXITMENU}
	};
	return specials;
}

static int telnet_connected(void *handle)
{
	Telnet telnet = (Telnet) handle;
	return telnet->s != NULL;
}

static int telnet_sendok(void *handle)
{
	/* Telnet telnet = (Telnet) handle; */
	return 1;
}

static void telnet_unthrottle(void *handle, int backlog)
{
	Telnet telnet = (Telnet) handle;
	sk_set_frozen(telnet->s, backlog > TELNET_MAX_BACKLOG);
}

static int telnet_ldisc(void *handle, int option)
{
	Telnet telnet = (Telnet) handle;
	if (option == LD_ECHO)
		return telnet->echoing;
	if (option == LD_EDIT)
		return telnet->editing;
	return FALSE;
}

static void telnet_provide_ldisc(void *handle, void *ldisc)
{
	Telnet telnet = (Telnet) handle;
	telnet->ldisc = ldisc;
}

static void telnet_provide_logctx(void *handle, void *logctx)
{
	/* This is a stub. */
}

static int telnet_exitcode(void *handle)
{
	Telnet telnet = (Telnet) handle;
	if (telnet->s != NULL)
		return -1;                     /* still connected */
	else if (telnet->closed_on_socket_error)
		return INT_MAX;     /* a socket error counts as an unclean exit */
	else
		/* Telnet doesn't transmit exit codes back to the client */
		return 0;
}

/*
* cfg_info for Telnet does nothing at all.
*/
static int telnet_cfg_info(void *handle)
{
	return 0;
}

Backend telnet_backend = {
	telnet_init,
	telnet_free,
	telnet_reconfig,
	telnet_send,
	telnet_sendbuffer,
	telnet_size,
	telnet_special,
	telnet_get_specials,
	telnet_connected,
	telnet_exitcode,
	telnet_sendok,
	telnet_ldisc,
	telnet_provide_ldisc,
	telnet_provide_logctx,
	telnet_unthrottle,
	telnet_cfg_info,
	NULL /* test_for_upstream */,
	"telnet",
	PROT_TELNET,
	23
};
